On the Instability of Software Dependency Graphs: A Maven Case Study

The widespread use of third-party libraries is a cornerstone of modern software development, with Maven Central serving as a critical repository for managing dependencies. This paper examines the relationships between artifacts, their releases, and dependencies within the Maven Central ecosystem, focusing on popular libraries with high influence. The Neo4jbased dataset containing 658,078 artifacts, 14,459,139 releases, and 44,035,495 added values was analyzed, identifying trends in artifact popularity, stability, and vulnerability. Instability metrics and dependency relationships were explored to assess adherence to design principles. In addition, the impact of critical vulnerabilities on ecosystem health was evaluated, demonstrating their adverse effects on dependent libraries. This study underscores the importance of stability, proactive vulnerability management, and robust dependency practices to ensure the resilience of Maven Central and its role in software development.